<!DOCTYPE html><html lang="zh-CN" data-theme="light"><head><meta charset="UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=1.0, maximum-scale=1.0, user-scalable=no"><title>k8s公网部署 | 惜缘怀古的博客</title><meta name="keywords" content="惜缘怀古，博客"><meta name="author" content="惜缘怀古"><meta name="copyright" content="惜缘怀古"><meta name="format-detection" content="telephone=no"><meta name="theme-color" content="#ffffff"><meta name="description" content="1CentOS 7.6 系统主机 3 台，基于公网 IP 搭建 1 主 2 从的 Kubernetes 集群     一、准备工作1.版本信息   Docker 20.10.21    Kubernetes 1.21.0-0   Flannel 0.20.2   2.集群角色规划3 台 CentOS 7.6 主机，集群角色规划如下     Master Worker01 Worker02    公">
<meta property="og:type" content="article">
<meta property="og:title" content="k8s公网部署">
<meta property="og:url" content="https://xiyuanhuaigu.gitee.io/2023/03/06/k8s%E5%85%AC%E7%BD%91%E9%83%A8%E7%BD%B2/index.html">
<meta property="og:site_name" content="惜缘怀古的博客">
<meta property="og:description" content="1CentOS 7.6 系统主机 3 台，基于公网 IP 搭建 1 主 2 从的 Kubernetes 集群     一、准备工作1.版本信息   Docker 20.10.21    Kubernetes 1.21.0-0   Flannel 0.20.2   2.集群角色规划3 台 CentOS 7.6 主机，集群角色规划如下     Master Worker01 Worker02    公">
<meta property="og:locale" content="zh_CN">
<meta property="og:image" content="https://xyhutc.oss-cn-qingdao.aliyuncs.com/giteetuchuang/9604cc9e45e234d534bda903e231df3e5be0b6c8_raw.jpg">
<meta property="article:published_time" content="2023-03-06T08:49:16.000Z">
<meta property="article:modified_time" content="2023-04-06T03:45:10.464Z">
<meta property="article:author" content="惜缘怀古">
<meta property="article:tag" content="惜缘怀古，博客">
<meta name="twitter:card" content="summary">
<meta name="twitter:image" content="https://xyhutc.oss-cn-qingdao.aliyuncs.com/giteetuchuang/9604cc9e45e234d534bda903e231df3e5be0b6c8_raw.jpg"><link rel="shortcut icon" href="/img/favicon.png"><link rel="canonical" href="https://xiyuanhuaigu.gitee.io/2023/03/06/k8s%E5%85%AC%E7%BD%91%E9%83%A8%E7%BD%B2/"><link rel="preconnect" href="//cdn.jsdelivr.net"/><link rel="preconnect" href="//busuanzi.ibruce.info"/><link rel="stylesheet" href="/css/index.css"><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free/css/all.min.css" media="print" onload="this.media='all'"><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@fancyapps/ui/dist/fancybox.css" media="print" onload="this.media='all'"><script>const GLOBAL_CONFIG = { 
  root: '/',
  algolia: undefined,
  localSearch: undefined,
  translate: undefined,
  noticeOutdate: undefined,
  highlight: {"plugin":"highlighjs","highlightCopy":true,"highlightLang":true,"highlightHeightLimit":false},
  copy: {
    success: '复制成功',
    error: '复制错误',
    noSupport: '浏览器不支持'
  },
  relativeDate: {
    homepage: false,
    post: false
  },
  runtime: '',
  date_suffix: {
    just: '刚刚',
    min: '分钟前',
    hour: '小时前',
    day: '天前',
    month: '个月前'
  },
  copyright: undefined,
  lightbox: 'fancybox',
  Snackbar: undefined,
  source: {
    jQuery: 'https://cdn.jsdelivr.net/npm/jquery@latest/dist/jquery.min.js',
    justifiedGallery: {
      js: 'https://cdn.jsdelivr.net/npm/justifiedGallery/dist/js/jquery.justifiedGallery.min.js',
      css: 'https://cdn.jsdelivr.net/npm/justifiedGallery/dist/css/justifiedGallery.min.css'
    }
  },
  isPhotoFigcaption: false,
  islazyload: false,
  isanchor: false
}</script><script id="config-diff">var GLOBAL_CONFIG_SITE = {
  title: 'k8s公网部署',
  isPost: true,
  isHome: false,
  isHighlightShrink: false,
  isToc: true,
  postUpdate: '2023-04-06 11:45:10'
}</script><noscript><style type="text/css">
  #nav {
    opacity: 1
  }
  .justified-gallery img {
    opacity: 1
  }

  #recent-posts time,
  #post-meta time {
    display: inline !important
  }
</style></noscript><script>(win=>{
    win.saveToLocal = {
      set: function setWithExpiry(key, value, ttl) {
        if (ttl === 0) return
        const now = new Date()
        const expiryDay = ttl * 86400000
        const item = {
          value: value,
          expiry: now.getTime() + expiryDay,
        }
        localStorage.setItem(key, JSON.stringify(item))
      },

      get: function getWithExpiry(key) {
        const itemStr = localStorage.getItem(key)

        if (!itemStr) {
          return undefined
        }
        const item = JSON.parse(itemStr)
        const now = new Date()

        if (now.getTime() > item.expiry) {
          localStorage.removeItem(key)
          return undefined
        }
        return item.value
      }
    }
  
    win.getScript = url => new Promise((resolve, reject) => {
      const script = document.createElement('script')
      script.src = url
      script.async = true
      script.onerror = reject
      script.onload = script.onreadystatechange = function() {
        const loadState = this.readyState
        if (loadState && loadState !== 'loaded' && loadState !== 'complete') return
        script.onload = script.onreadystatechange = null
        resolve()
      }
      document.head.appendChild(script)
    })
  
      win.activateDarkMode = function () {
        document.documentElement.setAttribute('data-theme', 'dark')
        if (document.querySelector('meta[name="theme-color"]') !== null) {
          document.querySelector('meta[name="theme-color"]').setAttribute('content', '#0d0d0d')
        }
      }
      win.activateLightMode = function () {
        document.documentElement.setAttribute('data-theme', 'light')
        if (document.querySelector('meta[name="theme-color"]') !== null) {
          document.querySelector('meta[name="theme-color"]').setAttribute('content', '#ffffff')
        }
      }
      const t = saveToLocal.get('theme')
    
          if (t === 'dark') activateDarkMode()
          else if (t === 'light') activateLightMode()
        
      const asideStatus = saveToLocal.get('aside-status')
      if (asideStatus !== undefined) {
        if (asideStatus === 'hide') {
          document.documentElement.classList.add('hide-aside')
        } else {
          document.documentElement.classList.remove('hide-aside')
        }
      }
    
    const detectApple = () => {
      if (GLOBAL_CONFIG_SITE.isHome && /iPad|iPhone|iPod|Macintosh/.test(navigator.userAgent)){
        document.documentElement.classList.add('apple')
      }
    }
    detectApple()
    })(window)</script><meta name="generator" content="Hexo 5.4.0"></head><body><div id="sidebar"><div id="menu-mask"></div><div id="sidebar-menus"><div class="avatar-img is-center"><img src="/img/2.jpg" onerror="onerror=null;src='/img/friend_404.gif'" alt="avatar"/></div><div class="site-data is-center"><div class="data-item"><a href="/archives/"><div class="headline">文章</div><div class="length-num">66</div></a></div><div class="data-item"><a href="/tags/"><div class="headline">标签</div><div class="length-num">0</div></a></div><div class="data-item"><a href="/categories/"><div class="headline">分类</div><div class="length-num">0</div></a></div></div><hr/></div></div><div class="post" id="body-wrap"><header class="post-bg" id="page-header" style="background-image: url('https://xyhutc.oss-cn-qingdao.aliyuncs.com/giteetuchuang/9604cc9e45e234d534bda903e231df3e5be0b6c8_raw.jpg')"><nav id="nav"><span id="blog_name"><a id="site-name" href="/">惜缘怀古的博客</a></span><div id="menus"><div id="toggle-menu"><a class="site-page"><i class="fas fa-bars fa-fw"></i></a></div></div></nav><div id="post-info"><h1 class="post-title">k8s公网部署</h1><div id="post-meta"><div class="meta-firstline"><span class="post-meta-date"><i class="far fa-calendar-alt fa-fw post-meta-icon"></i><span class="post-meta-label">发表于</span><time class="post-meta-date-created" datetime="2023-03-06T08:49:16.000Z" title="发表于 2023-03-06 16:49:16">2023-03-06</time><span class="post-meta-separator">|</span><i class="fas fa-history fa-fw post-meta-icon"></i><span class="post-meta-label">更新于</span><time class="post-meta-date-updated" datetime="2023-04-06T03:45:10.464Z" title="更新于 2023-04-06 11:45:10">2023-04-06</time></span></div><div class="meta-secondline"><span class="post-meta-separator">|</span><span class="post-meta-wordcount"><i class="far fa-file-word fa-fw post-meta-icon"></i><span class="post-meta-label">字数总计:</span><span class="word-count">3.2k</span><span class="post-meta-separator">|</span><i class="far fa-clock fa-fw post-meta-icon"></i><span class="post-meta-label">阅读时长:</span><span>16分钟</span></span><span class="post-meta-separator">|</span><span class="post-meta-pv-cv" id="" data-flag-title="k8s公网部署"><i class="far fa-eye fa-fw post-meta-icon"></i><span class="post-meta-label">阅读量:</span><span id="busuanzi_value_page_pv"></span></span></div></div></div></header><main class="layout" id="content-inner"><div id="post"><article class="post-content" id="article-container"><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">CentOS 7.6 系统主机 3 台，基于公网 IP 搭建 1 主 2 从的 Kubernetes 集群 </span><br></pre></td></tr></table></figure>



<h1 id="一、准备工作"><a href="#一、准备工作" class="headerlink" title="一、准备工作"></a>一、准备工作</h1><h2 id="1-版本信息"><a href="#1-版本信息" class="headerlink" title="1.版本信息"></a>1.版本信息</h2><table>
<thead>
<tr>
<th>Docker</th>
<th>20.10.21</th>
</tr>
</thead>
<tbody><tr>
<td>Kubernetes</td>
<td>1.21.0-0</td>
</tr>
<tr>
<td>Flannel</td>
<td>0.20.2</td>
</tr>
</tbody></table>
<h2 id="2-集群角色规划"><a href="#2-集群角色规划" class="headerlink" title="2.集群角色规划"></a>2.集群角色规划</h2><p>3 台 CentOS 7.6 主机，集群角色规划如下</p>
<table>
<thead>
<tr>
<th></th>
<th><strong>Master</strong></th>
<th><strong>Worker01</strong></th>
<th><strong>Worker02</strong></th>
</tr>
</thead>
<tbody><tr>
<td><strong>公网 IP</strong></td>
<td>139.196.219.92</td>
<td>1.116.156.102</td>
<td>121.37.169.103</td>
</tr>
<tr>
<td><strong>内网 IP</strong></td>
<td>172.21.253.164</td>
<td>10.0.4.15</td>
<td>192.168.0.89</td>
</tr>
<tr>
<td><strong>服务器厂商</strong></td>
<td>阿里云</td>
<td>腾讯云</td>
<td>阿里云云</td>
</tr>
</tbody></table>
<h2 id="3-修改-hosts-文件"><a href="#3-修改-hosts-文件" class="headerlink" title="3.修改 hosts 文件"></a>3.修改 hosts 文件</h2><p>设置 master 主机的 hostname 为 m</p>
<figure class="highlight arduino"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">sudo hostnamectl set-hostname m</span><br></pre></td></tr></table></figure>

<p>分别设置 2 台 worker 主机的 hostname</p>
<figure class="highlight arduino"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">sudo hostnamectl set-hostname w1 </span><br><span class="line">sudo hostnamectl set-hostname w2</span><br></pre></td></tr></table></figure>

<p>分别修改 3 台主机的 hosts 文件，这里配置的是公网 IP。因为云服务器厂商不同，无法搭建局域网 K8s 集群</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">vim /etc/hosts</span><br><span class="line"> </span><br><span class="line">139.196.219.92 m </span><br><span class="line">1.116.156.102 w1 </span><br><span class="line">121.37.169.103 w2</span><br></pre></td></tr></table></figure>

<h2 id="4-创建虚拟网卡"><a href="#4-创建虚拟网卡" class="headerlink" title="4.创建虚拟网卡"></a>4.创建虚拟网卡</h2><p>3 台主机分别填写对应的公网 IP</p>
<figure class="highlight ini"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># 打开文件</span></span><br><span class="line">vim /etc/sysconfig/network-scripts/ifcfg-eth0:1</span><br><span class="line"></span><br><span class="line"><span class="comment"># 填入内容</span></span><br><span class="line"><span class="attr">NAME</span>=eth0:<span class="number">1</span></span><br><span class="line"><span class="attr">DEVICE</span>=eth0:<span class="number">1</span></span><br><span class="line"><span class="attr">TYPE</span>=Ethernet</span><br><span class="line"><span class="attr">ONBOOT</span>=<span class="literal">yes</span></span><br><span class="line"><span class="attr">BOOTPROTO</span>=static</span><br><span class="line"><span class="attr">NETMASK</span>=<span class="number">255.255</span>.<span class="number">255.0</span></span><br><span class="line"><span class="attr">IPADDR</span>=&lt;public ip&gt;</span><br><span class="line"></span><br><span class="line"><span class="comment"># 重启网络</span></span><br><span class="line">systemctl restart network.service</span><br></pre></td></tr></table></figure>

<p>注：CentOS 8取消了network.service，若命令不成功请自行百度</p>
<p>创建虚拟网卡前，查看 eth0</p>
<figure class="highlight csharp"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">[<span class="meta">root@w1 network-scripts</span>]<span class="meta"># ip a | grep eth0</span></span><br><span class="line"></span><br><span class="line"><span class="number">2</span>: eth0: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu <span class="number">1500</span> qdisc mq state UP <span class="keyword">group</span> <span class="literal">default</span> qlen <span class="number">1000</span></span><br><span class="line">    inet <span class="number">10.0</span><span class="number">.4</span><span class="number">.15</span>/<span class="number">22</span> brd <span class="number">10.0</span><span class="number">.7</span><span class="number">.255</span> scope <span class="keyword">global</span> eth0</span><br></pre></td></tr></table></figure>

<p>创建虚拟网卡后，查看 eth0，可以发现多了一条记录 eth0:1</p>
<figure class="highlight sql"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">[root<span class="variable">@w1</span> <span class="operator">~</span>]# ip a <span class="operator">|</span> grep eth0</span><br><span class="line"></span><br><span class="line"><span class="number">2</span>: eth0: <span class="operator">&lt;</span>BROADCAST,MULTICAST,UP,LOWER_UP<span class="operator">&gt;</span> mtu <span class="number">1500</span> qdisc mq state UP <span class="keyword">group</span> <span class="keyword">default</span> qlen <span class="number">1000</span></span><br><span class="line">    inet <span class="number">10.0</span><span class="number">.4</span><span class="number">.15</span><span class="operator">/</span><span class="number">22</span> brd <span class="number">10.0</span><span class="number">.7</span><span class="number">.255</span> <span class="keyword">scope</span> <span class="keyword">global</span> eth0</span><br><span class="line">    inet <span class="number">1.116</span><span class="number">.156</span><span class="number">.102</span><span class="operator">/</span><span class="number">24</span> brd <span class="number">1.116</span><span class="number">.156</span><span class="number">.255</span> <span class="keyword">scope</span> <span class="keyword">global</span> eth0:<span class="number">1</span></span><br></pre></td></tr></table></figure>

<h2 id="5-云服务器安全组设置"><a href="#5-云服务器安全组设置" class="headerlink" title="5.云服务器安全组设置"></a>5.云服务器安全组设置</h2><p>搭建 K8s 集群需要对云服务器安全组入方向规则进行配置，开启相应的端口</p>
<p>master 节点</p>
<table>
<thead>
<tr>
<th><strong>协议</strong></th>
<th><strong>端口</strong></th>
<th><strong>作用</strong></th>
<th><strong>使用者</strong></th>
</tr>
</thead>
<tbody><tr>
<td>TCP</td>
<td>2379～2380</td>
<td>etcd 客户端 API</td>
<td>kube-apiserver, etcd</td>
</tr>
<tr>
<td>TCP</td>
<td>6443</td>
<td>api-server API</td>
<td>所有组件</td>
</tr>
<tr>
<td>UDP</td>
<td>8472</td>
<td>VxLan Overlay 网络通信</td>
<td>Flannel 网络插件</td>
</tr>
<tr>
<td>TCP</td>
<td>10250</td>
<td>kubelet API</td>
<td>kubelet, Control Plane 组件</td>
</tr>
<tr>
<td>TCP</td>
<td>10251</td>
<td>kube-scheduler</td>
<td>kube-scheduler</td>
</tr>
<tr>
<td>TCP</td>
<td>10252</td>
<td>kube-controller-manager</td>
<td>kube-controller-manager</td>
</tr>
</tbody></table>
<p>worker 节点</p>
<table>
<thead>
<tr>
<th><strong>协议</strong></th>
<th><strong>端口</strong></th>
<th><strong>作用</strong></th>
<th><strong>使用者</strong></th>
</tr>
</thead>
<tbody><tr>
<td>UDP</td>
<td>8472</td>
<td>VxLan Overlay 网络通信</td>
<td>Flannel 网络插件</td>
</tr>
<tr>
<td>TCP</td>
<td>10250</td>
<td>kubelet API</td>
<td>kubelet, Control Plane 组件</td>
</tr>
<tr>
<td>TCP</td>
<td>30000~32767</td>
<td>NodePort 服务</td>
<td>所有组件</td>
</tr>
</tbody></table>
<h1 id="二、系统基础配置"><a href="#二、系统基础配置" class="headerlink" title="二、系统基础配置"></a>二、系统基础配置</h1><h2 id="1-更新并安装依赖"><a href="#1-更新并安装依赖" class="headerlink" title="1.更新并安装依赖"></a>1.更新并安装依赖</h2><p>准备好 3 台主机后，每台主机均需要更新并安装依赖</p>
<figure class="highlight sql"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">sudo yum <span class="operator">-</span>y update </span><br><span class="line">sudo yum install <span class="operator">-</span>y conntrack ipvsadm ipset jq sysstat curl iptables libseccomp</span><br><span class="line">sudo yum install <span class="operator">-</span>y yum<span class="operator">-</span>utils</span><br></pre></td></tr></table></figure>

<h2 id="2-基础配置"><a href="#2-基础配置" class="headerlink" title="2.基础配置"></a>2.基础配置</h2><p>关闭防火墙</p>
<figure class="highlight arduino"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">systemctl stop firewalld &amp;&amp; systemctl disable firewalld</span><br></pre></td></tr></table></figure>

<p>关闭 SELinux (Security Enhanced Linux)</p>
<figure class="highlight arduino"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">setenforce <span class="number">0</span></span><br><span class="line">sed -i <span class="string">&#x27;s/^SELINUX=enforcing$/SELINUX=permissive/&#x27;</span> /etc/selinux/config</span><br></pre></td></tr></table></figure>

<p>关闭 swap</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">swapoff -a</span><br><span class="line">sed -i <span class="string">&#x27;/swap/s/^(.*)$/#\1/g&#x27;</span> /etc/fstab</span><br></pre></td></tr></table></figure>

<p>配置 iptables 的 ACCEPT 规则</p>
<figure class="highlight r"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">iptables -<span class="built_in">F</span> &amp;&amp; iptables -X &amp;&amp; iptables -<span class="built_in">F</span> -t nat &amp;&amp; iptables -X -t nat &amp;&amp; iptables -P FORWARD ACCEPT</span><br></pre></td></tr></table></figure>

<p>设置系统参数</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">cat &lt;&lt;<span class="string">EOF&gt; /etc/sysctl.d/k8s.conf </span></span><br><span class="line"><span class="string">net.bridge.bridge-nf-call-ip6tables = 1 </span></span><br><span class="line"><span class="string">net.bridge.bridge-nf-call-iptables = 1 </span></span><br><span class="line"><span class="string">EOF</span></span><br><span class="line">sysctl --system</span><br></pre></td></tr></table></figure>

<h1 id="三、安装-Docker"><a href="#三、安装-Docker" class="headerlink" title="三、安装 Docker"></a>三、安装 Docker</h1><h2 id="1-配置阿里云镜像源"><a href="#1-配置阿里云镜像源" class="headerlink" title="1.配置阿里云镜像源"></a>1.配置阿里云镜像源</h2><figure class="highlight csharp"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line">sudo yum-config-manager \</span><br><span class="line">    --<span class="keyword">add</span>-repo http:<span class="comment">//mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo</span></span><br><span class="line"></span><br><span class="line"><span class="meta"># 查看 Docker-CE</span></span><br><span class="line">yum list | grep docker-ce</span><br><span class="line"></span><br><span class="line"><span class="meta"># 更新 yum 缓存</span></span><br><span class="line">sudo yum makecache fast</span><br></pre></td></tr></table></figure>

<h2 id="2-安装-Docker"><a href="#2-安装-Docker" class="headerlink" title="2.安装 Docker"></a>2.安装 Docker</h2><p>安装指定版本 20.10.21</p>
<figure class="highlight lua"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">sudo yum install -y docker-ce<span class="number">-20.10</span><span class="number">.21</span> docker-ce-cli<span class="number">-20.10</span><span class="number">.21</span> containerd.<span class="built_in">io</span></span><br></pre></td></tr></table></figure>

<h2 id="3-启动-Docker"><a href="#3-启动-Docker" class="headerlink" title="3.启动 Docker"></a>3.启动 Docker</h2><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># 启动 Docker</span></span><br><span class="line">sudo systemctl start docker</span><br><span class="line"><span class="comment"># 设置开机启动 Docker</span></span><br><span class="line">sudo systemctl <span class="built_in">enable</span> docker</span><br></pre></td></tr></table></figure>

<h1 id="四、安装-Kubernetes-集群所需组件"><a href="#四、安装-Kubernetes-集群所需组件" class="headerlink" title="四、安装 Kubernetes 集群所需组件"></a>四、安装 Kubernetes 集群所需组件</h1><h2 id="一-安装-kubeadm-kubelete-kubectl"><a href="#一-安装-kubeadm-kubelete-kubectl" class="headerlink" title="(一) 安装 kubeadm, kubelete, kubectl"></a>(一) 安装 kubeadm, kubelete, kubectl</h2><h3 id="1-配置-yum-源"><a href="#1-配置-yum-源" class="headerlink" title="1.配置 yum 源"></a>1.配置 yum 源</h3><figure class="highlight ini"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line">cat &lt;&lt;EOF&gt; /etc/yum.repos.d/kubernetes.repo </span><br><span class="line"><span class="section">[kubernetes]</span> </span><br><span class="line"><span class="attr">name</span>=Kubernetes </span><br><span class="line"><span class="attr">baseurl</span>=http://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x<span class="number">86_64</span> </span><br><span class="line"><span class="attr">enabled</span>=<span class="number">1</span> </span><br><span class="line"><span class="attr">gpgcheck</span>=<span class="number">0</span> </span><br><span class="line"><span class="attr">repo_gpgcheck</span>=<span class="number">0</span> </span><br><span class="line"><span class="attr">gpgkey</span>=http://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg </span><br><span class="line">    http://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg </span><br><span class="line">EOF</span><br></pre></td></tr></table></figure>

<h3 id="2-开始安装"><a href="#2-开始安装" class="headerlink" title="2.开始安装"></a>2.开始安装</h3><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># 确认 yum 中是否有指定版本</span></span><br><span class="line">yum list kubeadm --showduplicates | sort -r</span><br><span class="line"></span><br><span class="line"><span class="comment"># 安装 1.21.0-0</span></span><br><span class="line">yum install -y kubeadm-1.21.0-0 kubelet-1.21.0-0 kubectl-1.21.0-0</span><br></pre></td></tr></table></figure>

<h3 id="3-Docker-和-K8s-设置为同一个-cgroup"><a href="#3-Docker-和-K8s-设置为同一个-cgroup" class="headerlink" title="3.Docker 和 K8s 设置为同一个 cgroup"></a>3.Docker 和 K8s 设置为同一个 cgroup</h3><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line">(1) 修改 daemon.json</span><br><span class="line">vim /etc/docker/daemon.json</span><br><span class="line">设置 cgroup</span><br><span class="line"><span class="string">&quot;exec-opts&quot;</span>: [<span class="string">&quot;native.cgroupdriver=systemd&quot;</span>]</span><br><span class="line"></span><br><span class="line">(2) 重启 Docker</span><br><span class="line">systemctl restart docker</span><br><span class="line"></span><br><span class="line">(3) 检查 kubelet，如果在输出信息中发现 No such file or directory，说明没问题</span><br><span class="line">sed -i <span class="string">&quot;s/cgroup-driver=systemd/cgroup-driver=cgroupfs/g&quot;</span> /etc/systemd/system/kubelet.service.d/10-kubeadm.conf</span><br></pre></td></tr></table></figure>

<h3 id="4-修改-kubelet-启动参数"><a href="#4-修改-kubelet-启动参数" class="headerlink" title="4.修改 kubelet 启动参数"></a>4.修改 kubelet 启动参数</h3><p>每台主机都要添加并指定对应的公网 IP，然后才能使用公网 IP 进行集群间通信</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">vim /usr/lib/systemd/system/kubelet.service.d/10-kubeadm.conf</span><br><span class="line"></span><br></pre></td></tr></table></figure>

<p>在 KUBELET_KUBECONFIG_ARGS 后面追加 –node-ip=<public_ip>（此处填写你的公网ip）</p>
<p>修改之后执行 daemon-reload 让修改生效</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">systemctl daemon-reload</span><br></pre></td></tr></table></figure>

<h3 id="5-启动-kubelet-重启-kubelet"><a href="#5-启动-kubelet-重启-kubelet" class="headerlink" title="5.启动 kubelet / 重启 kubelet"></a>5.启动 kubelet / 重启 kubelet</h3><p>启动 kubelet</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">systemctl <span class="built_in">enable</span> kubelet &amp;&amp; systemctl start kubelet</span><br></pre></td></tr></table></figure>

<p>重启 kubelet</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">systemctl restart kubelet</span><br></pre></td></tr></table></figure>

<h2 id="二-拉取-kube-proxy-scheduler-等镜像"><a href="#二-拉取-kube-proxy-scheduler-等镜像" class="headerlink" title="(二) 拉取 kube-proxy, scheduler 等镜像"></a>(二) 拉取 kube-proxy, scheduler 等镜像</h2><p>需要通过国内镜像源下载镜像</p>
<h3 id="1-查看-kubeadm-所需镜像"><a href="#1-查看-kubeadm-所需镜像" class="headerlink" title="1.查看 kubeadm 所需镜像"></a>1.查看 kubeadm 所需镜像</h3><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">kubeadm config images list</span><br></pre></td></tr></table></figure>

<p>输出信息如下</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">k8s.gcr.io/kube-apiserver:v1.21.14</span><br><span class="line">k8s.gcr.io/kube-controller-manager:v1.21.14</span><br><span class="line">k8s.gcr.io/kube-scheduler:v1.21.14</span><br><span class="line">k8s.gcr.io/kube-proxy:v1.21.14</span><br><span class="line">k8s.gcr.io/pause:3.4.1</span><br><span class="line">k8s.gcr.io/etcd:3.4.13-0</span><br><span class="line">k8s.gcr.io/coredns/coredns:v1.8.0</span><br></pre></td></tr></table></figure>

<p>遗憾的是需要科学上网才能下载这些镜像</p>
<h3 id="2-尝试用国内镜像源拉取镜像"><a href="#2-尝试用国内镜像源拉取镜像" class="headerlink" title="2.尝试用国内镜像源拉取镜像"></a>2.尝试用国内镜像源拉取镜像</h3><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">docker pull registry.cn-hangzhou.aliyuncs.com/google_containers/kube-apiserver:v1.21.14</span><br></pre></td></tr></table></figure>

<p>经过测试，可以正常拉取，因此编写一个 Shell 脚本，通过国内镜像源拉取 kubeadm 所需镜像</p>
<p>切换到一个目录，编写 kubeadm_image.sh，用于从阿里云镜像源拉取镜像 / 重新打 tag / 删除原镜像</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">#!/usr/bin/env bash</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># 镜像处理过程中，如果遇到错误，立即退出</span></span><br><span class="line"><span class="built_in">set</span> -e</span><br><span class="line"></span><br><span class="line"><span class="comment"># 版本定义</span></span><br><span class="line"><span class="built_in">readonly</span> KUBE_VERSION=v1.21.0</span><br><span class="line"><span class="built_in">readonly</span> PAUSE_VERSION=3.4.1</span><br><span class="line"><span class="built_in">readonly</span> ETCD_VERSION=3.4.13-0</span><br><span class="line"><span class="built_in">readonly</span> CORE_DNS_VERSION=v1.8.0</span><br><span class="line"><span class="built_in">readonly</span> OFFICIAL_URL=k8s.gcr.io</span><br><span class="line"><span class="built_in">readonly</span> ALIYUN_URL=registry.cn-hangzhou.aliyuncs.com/google_containers</span><br><span class="line"></span><br><span class="line"><span class="comment"># 镜像列表</span></span><br><span class="line">imageList=(kube-apiserver:<span class="variable">$&#123;KUBE_VERSION&#125;</span> </span><br><span class="line">kube-controller-manager:<span class="variable">$&#123;KUBE_VERSION&#125;</span> </span><br><span class="line">kube-scheduler:<span class="variable">$&#123;KUBE_VERSION&#125;</span> </span><br><span class="line">kube-proxy:<span class="variable">$&#123;KUBE_VERSION&#125;</span> </span><br><span class="line">pause:<span class="variable">$&#123;PAUSE_VERSION&#125;</span> </span><br><span class="line">etcd:<span class="variable">$&#123;ETCD_VERSION&#125;</span> </span><br><span class="line">coredns:<span class="variable">$&#123;CORE_DNS_VERSION&#125;</span>)</span><br><span class="line"></span><br><span class="line"><span class="comment"># 镜像转换操作</span></span><br><span class="line"><span class="keyword">for</span> imageItem <span class="keyword">in</span> <span class="variable">$&#123;imageList[@]&#125;</span> ; <span class="keyword">do</span> </span><br><span class="line">  <span class="comment"># 从国内镜像源拉取镜像</span></span><br><span class="line">  docker pull <span class="variable">$ALIYUN_URL</span>/<span class="variable">$imageItem</span></span><br><span class="line">  <span class="comment"># 给镜像重新打一个标签，命名为 kubeadm 所需的镜像</span></span><br><span class="line">  docker tag <span class="variable">$ALIYUN_URL</span>/<span class="variable">$imageItem</span> <span class="variable">$OFFICIAL_URL</span>/<span class="variable">$imageItem</span></span><br><span class="line">  <span class="comment"># 删除原有镜像</span></span><br><span class="line">  docker rmi <span class="variable">$ALIYUN_URL</span>/<span class="variable">$imageItem</span></span><br><span class="line"><span class="keyword">done</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># coredns 的镜像比较特殊，单独处理</span></span><br><span class="line">docker tag <span class="variable">$&#123;OFFICIAL_URL&#125;</span>/coredns:<span class="variable">$&#123;CORE_DNS_VERSION&#125;</span> <span class="variable">$&#123;OFFICIAL_URL&#125;</span>/coredns/coredns:<span class="variable">$&#123;CORE_DNS_VERSION&#125;</span></span><br><span class="line">docker rmi <span class="variable">$&#123;OFFICIAL_URL&#125;</span>/coredns:<span class="variable">$&#123;CORE_DNS_VERSION</span></span><br></pre></td></tr></table></figure>

<p>运行脚本</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">sh ./kubeadm_image.sh</span><br></pre></td></tr></table></figure>

<h1 id="五、搭建-Kubernetes-集群"><a href="#五、搭建-Kubernetes-集群" class="headerlink" title="五、搭建 Kubernetes 集群"></a>五、搭建 Kubernetes 集群</h1><h2 id="一-用-kubeadm-初始化-master-节点"><a href="#一-用-kubeadm-初始化-master-节点" class="headerlink" title="(一)用 kubeadm 初始化 master 节点"></a>(一)用 kubeadm 初始化 master 节点</h2><h3 id="1-执行-kubeadm-init"><a href="#1-执行-kubeadm-init" class="headerlink" title="1.执行 kubeadm init"></a>1.执行 kubeadm init</h3><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">kubeadm init --kubernetes-version=1.21.0 \</span><br><span class="line">  --apiserver-advertise-address=39.98.182.32 \</span><br><span class="line">  --pod-network-cidr=10.244.0.0/16 \</span><br><span class="line">  -v=5</span><br></pre></td></tr></table></figure>

<p>输出日志中出现如下信息时，说明 master 节点已经初始化成功了</p>
<blockquote>
<p>Your Kubernetes control-plane has initialized successfully!</p>
</blockquote>
<p>将末尾的 kubeadm join 信息保存起来，后面的步骤中需要在 worker 节点执行</p>
<h3 id="2-集群健康检查"><a href="#2-集群健康检查" class="headerlink" title="2.集群健康检查"></a>2.集群健康检查</h3><p>执行如下命令</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">mkdir -p $HOME/.kube</span><br><span class="line">sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config</span><br><span class="line">sudo chown $(id -u):$(id -g) $HOME/.kube/config</span><br></pre></td></tr></table></figure>

<p>集群健康检查</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line"># 检查集群状态</span><br><span class="line">kubectl cluster-info</span><br><span class="line"></span><br><span class="line"># 健康检查</span><br><span class="line">curl -k https://localhost:6443/healthz</span><br></pre></td></tr></table></figure>

<h3 id="3-修改kube-apiserver-配置"><a href="#3-修改kube-apiserver-配置" class="headerlink" title="3.修改kube-apiserver 配置"></a>3.修改kube-apiserver 配置</h3><p>kube-apiserver 添加 –bind-address=0.0.0.0，确认 –advertise-addres=&lt;公网 IP&gt;</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">vim /etc/kubernetes/manifests/kube-apiserver.yaml</span><br></pre></td></tr></table></figure>

<h2 id="二-安装网络插件-Flannel"><a href="#二-安装网络插件-Flannel" class="headerlink" title="(二)安装网络插件 Flannel"></a>(二)安装网络插件 Flannel</h2><h3 id="1-当前集群状态"><a href="#1-当前集群状态" class="headerlink" title="1.当前集群状态"></a>1.当前集群状态</h3><figure class="highlight sql"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">kubectl <span class="keyword">get</span> pods <span class="operator">-</span>n kube<span class="operator">-</span><span class="keyword">system</span></span><br><span class="line">kubectl <span class="keyword">get</span> nodes</span><br></pre></td></tr></table></figure>

<p>可以看到，两个 coredns 还是 Pending 状态，此时还缺少网络插件</p>
<h3 id="2-安装-Flannel-网络插件"><a href="#2-安装-Flannel-网络插件" class="headerlink" title="2.安装 Flannel 网络插件"></a>2.安装 Flannel 网络插件</h3><p>Kubernetes 为了让网络功能更加灵活，制定了 CNI 规范，由第三方实现网络的细节功能。目前有多种网络插件可供选择，使用较多的是 Calico 和 Flannel，其他的网络插件参考官方文档：<a href="https://link.juejin.cn/?target=https://kubernetes.io/docs/concepts/cluster-administration/addons/">链接</a></p>
<p>由于公网环境使用 Calico 网络插件配置比较复杂，也没有调试成功，因此本文使用 Flannel 网络插件，安装命令如下，在 master 节点执行</p>
<figure class="highlight ruby"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># 进入一个目录，假设为 /var/local/k8s</span></span><br><span class="line">wget <span class="symbol">https:</span>/<span class="regexp">/raw.githubusercontent.com/coreos</span><span class="regexp">/flannel/master</span><span class="regexp">/Documentation/kube</span>-flannel.yml</span><br></pre></td></tr></table></figure>

<p>修改 kube-flannel.yml，新增 2 个配置</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">vim kube-flannel.yml</span><br></pre></td></tr></table></figure>

<p>第 1 处</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><span class="line">containers:</span><br><span class="line">- name: kube-flannel</span><br><span class="line">  #image: flannelcni/flannel:v0.20.2 #for ppc64le and mips64le (dockerhub limitations may apply)</span><br><span class="line">  image: docker.io/rancher/mirrored-flannelcni-flannel:v0.20.2</span><br><span class="line">  command:</span><br><span class="line">  - /opt/bin/flanneld</span><br><span class="line">  args:</span><br><span class="line">  - --public-ip=$(PUBLIC_IP)</span><br><span class="line">  - --iface=eth0</span><br><span class="line">  - --ip-masq</span><br><span class="line">  - --kube-subnet-mgr</span><br></pre></td></tr></table></figure>

<p>第 2 处</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">env:</span><br><span class="line">- name: PUBLIC_IP</span><br><span class="line">  valueFrom:</span><br><span class="line">    fieldRef:</span><br><span class="line">      fieldPath: status.podIP</span><br></pre></td></tr></table></figure>

<p>执行安装命令</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">kubectl apply -f kube-flannel.yml</span><br></pre></td></tr></table></figure>

<h2 id="三-用-kubeadm-将从节点加入集群"><a href="#三-用-kubeadm-将从节点加入集群" class="headerlink" title="(三)用 kubeadm 将从节点加入集群"></a>(三)用 kubeadm 将从节点加入集群</h2><p>执行如下命令，将 worker 节点加入集群</p>
<figure class="highlight sql"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">kubeadm <span class="keyword">join</span> <span class="number">139.196</span><span class="number">.219</span><span class="number">.92</span>:<span class="number">6443</span> <span class="comment">--token o0zxc6.fmmh2sn8wlbt9onm \</span></span><br><span class="line">  <span class="comment">--discovery-token-ca-cert-hash sha256:a52cec58178c402ecaecc74375d49495c1bf13661dd0b25b158e7caf5d619fa6 \</span></span><br><span class="line">  <span class="operator">-</span>v<span class="operator">=</span><span class="number">5</span></span><br><span class="line">复制代码</span><br></pre></td></tr></table></figure>

<p>输出日志中出现如下信息时，说明 worker 节点已经成功加入集群</p>
<blockquote>
<p>This node has joined the cluster</p>
</blockquote>
<h1 id="六、部署dashboard"><a href="#六、部署dashboard" class="headerlink" title="六、部署dashboard"></a>六、部署dashboard</h1><h2 id="1、部署"><a href="#1、部署" class="headerlink" title="1、部署"></a>1、部署</h2><p>kubernetes官方提供的可视化界面</p>
<p><a target="_blank" rel="noopener" href="https://github.com/kubernetes/dashboard">https://github.com/kubernetes/dashboard</a></p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.3.1/aio/deploy/recommended.yaml</span><br></pre></td></tr></table></figure>

<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br><span class="line">71</span><br><span class="line">72</span><br><span class="line">73</span><br><span class="line">74</span><br><span class="line">75</span><br><span class="line">76</span><br><span class="line">77</span><br><span class="line">78</span><br><span class="line">79</span><br><span class="line">80</span><br><span class="line">81</span><br><span class="line">82</span><br><span class="line">83</span><br><span class="line">84</span><br><span class="line">85</span><br><span class="line">86</span><br><span class="line">87</span><br><span class="line">88</span><br><span class="line">89</span><br><span class="line">90</span><br><span class="line">91</span><br><span class="line">92</span><br><span class="line">93</span><br><span class="line">94</span><br><span class="line">95</span><br><span class="line">96</span><br><span class="line">97</span><br><span class="line">98</span><br><span class="line">99</span><br><span class="line">100</span><br><span class="line">101</span><br><span class="line">102</span><br><span class="line">103</span><br><span class="line">104</span><br><span class="line">105</span><br><span class="line">106</span><br><span class="line">107</span><br><span class="line">108</span><br><span class="line">109</span><br><span class="line">110</span><br><span class="line">111</span><br><span class="line">112</span><br><span class="line">113</span><br><span class="line">114</span><br><span class="line">115</span><br><span class="line">116</span><br><span class="line">117</span><br><span class="line">118</span><br><span class="line">119</span><br><span class="line">120</span><br><span class="line">121</span><br><span class="line">122</span><br><span class="line">123</span><br><span class="line">124</span><br><span class="line">125</span><br><span class="line">126</span><br><span class="line">127</span><br><span class="line">128</span><br><span class="line">129</span><br><span class="line">130</span><br><span class="line">131</span><br><span class="line">132</span><br><span class="line">133</span><br><span class="line">134</span><br><span class="line">135</span><br><span class="line">136</span><br><span class="line">137</span><br><span class="line">138</span><br><span class="line">139</span><br><span class="line">140</span><br><span class="line">141</span><br><span class="line">142</span><br><span class="line">143</span><br><span class="line">144</span><br><span class="line">145</span><br><span class="line">146</span><br><span class="line">147</span><br><span class="line">148</span><br><span class="line">149</span><br><span class="line">150</span><br><span class="line">151</span><br><span class="line">152</span><br><span class="line">153</span><br><span class="line">154</span><br><span class="line">155</span><br><span class="line">156</span><br><span class="line">157</span><br><span class="line">158</span><br><span class="line">159</span><br><span class="line">160</span><br><span class="line">161</span><br><span class="line">162</span><br><span class="line">163</span><br><span class="line">164</span><br><span class="line">165</span><br><span class="line">166</span><br><span class="line">167</span><br><span class="line">168</span><br><span class="line">169</span><br><span class="line">170</span><br><span class="line">171</span><br><span class="line">172</span><br><span class="line">173</span><br><span class="line">174</span><br><span class="line">175</span><br><span class="line">176</span><br><span class="line">177</span><br><span class="line">178</span><br><span class="line">179</span><br><span class="line">180</span><br><span class="line">181</span><br><span class="line">182</span><br><span class="line">183</span><br><span class="line">184</span><br><span class="line">185</span><br><span class="line">186</span><br><span class="line">187</span><br><span class="line">188</span><br><span class="line">189</span><br><span class="line">190</span><br><span class="line">191</span><br><span class="line">192</span><br><span class="line">193</span><br><span class="line">194</span><br><span class="line">195</span><br><span class="line">196</span><br><span class="line">197</span><br><span class="line">198</span><br><span class="line">199</span><br><span class="line">200</span><br><span class="line">201</span><br><span class="line">202</span><br><span class="line">203</span><br><span class="line">204</span><br><span class="line">205</span><br><span class="line">206</span><br><span class="line">207</span><br><span class="line">208</span><br><span class="line">209</span><br><span class="line">210</span><br><span class="line">211</span><br><span class="line">212</span><br><span class="line">213</span><br><span class="line">214</span><br><span class="line">215</span><br><span class="line">216</span><br><span class="line">217</span><br><span class="line">218</span><br><span class="line">219</span><br><span class="line">220</span><br><span class="line">221</span><br><span class="line">222</span><br><span class="line">223</span><br><span class="line">224</span><br><span class="line">225</span><br><span class="line">226</span><br><span class="line">227</span><br><span class="line">228</span><br><span class="line">229</span><br><span class="line">230</span><br><span class="line">231</span><br><span class="line">232</span><br><span class="line">233</span><br><span class="line">234</span><br><span class="line">235</span><br><span class="line">236</span><br><span class="line">237</span><br><span class="line">238</span><br><span class="line">239</span><br><span class="line">240</span><br><span class="line">241</span><br><span class="line">242</span><br><span class="line">243</span><br><span class="line">244</span><br><span class="line">245</span><br><span class="line">246</span><br><span class="line">247</span><br><span class="line">248</span><br><span class="line">249</span><br><span class="line">250</span><br><span class="line">251</span><br><span class="line">252</span><br><span class="line">253</span><br><span class="line">254</span><br><span class="line">255</span><br><span class="line">256</span><br><span class="line">257</span><br><span class="line">258</span><br><span class="line">259</span><br><span class="line">260</span><br><span class="line">261</span><br><span class="line">262</span><br><span class="line">263</span><br><span class="line">264</span><br><span class="line">265</span><br><span class="line">266</span><br><span class="line">267</span><br><span class="line">268</span><br><span class="line">269</span><br><span class="line">270</span><br><span class="line">271</span><br><span class="line">272</span><br><span class="line">273</span><br><span class="line">274</span><br><span class="line">275</span><br><span class="line">276</span><br><span class="line">277</span><br><span class="line">278</span><br><span class="line">279</span><br><span class="line">280</span><br><span class="line">281</span><br><span class="line">282</span><br><span class="line">283</span><br><span class="line">284</span><br><span class="line">285</span><br><span class="line">286</span><br><span class="line">287</span><br><span class="line">288</span><br><span class="line">289</span><br><span class="line">290</span><br><span class="line">291</span><br><span class="line">292</span><br><span class="line">293</span><br><span class="line">294</span><br><span class="line">295</span><br><span class="line">296</span><br><span class="line">297</span><br><span class="line">298</span><br><span class="line">299</span><br><span class="line">300</span><br><span class="line">301</span><br><span class="line">302</span><br></pre></td><td class="code"><pre><span class="line"># Copyright 2017 The Kubernetes Authors.</span><br><span class="line">#</span><br><span class="line"># Licensed under the Apache License, Version 2.0 (the &quot;License&quot;);</span><br><span class="line"># you may not use this file except in compliance with the License.</span><br><span class="line"># You may obtain a copy of the License at</span><br><span class="line">#</span><br><span class="line">#     http://www.apache.org/licenses/LICENSE-2.0</span><br><span class="line">#</span><br><span class="line"># Unless required by applicable law or agreed to in writing, software</span><br><span class="line"># distributed under the License is distributed on an &quot;AS IS&quot; BASIS,</span><br><span class="line"># WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.</span><br><span class="line"># See the License for the specific language governing permissions and</span><br><span class="line"># limitations under the License.</span><br><span class="line"></span><br><span class="line">apiVersion: v1</span><br><span class="line">kind: Namespace</span><br><span class="line">metadata:</span><br><span class="line">  name: kubernetes-dashboard</span><br><span class="line"></span><br><span class="line">---</span><br><span class="line"></span><br><span class="line">apiVersion: v1</span><br><span class="line">kind: ServiceAccount</span><br><span class="line">metadata:</span><br><span class="line">  labels:</span><br><span class="line">    k8s-app: kubernetes-dashboard</span><br><span class="line">  name: kubernetes-dashboard</span><br><span class="line">  namespace: kubernetes-dashboard</span><br><span class="line"></span><br><span class="line">---</span><br><span class="line"></span><br><span class="line">kind: Service</span><br><span class="line">apiVersion: v1</span><br><span class="line">metadata:</span><br><span class="line">  labels:</span><br><span class="line">    k8s-app: kubernetes-dashboard</span><br><span class="line">  name: kubernetes-dashboard</span><br><span class="line">  namespace: kubernetes-dashboard</span><br><span class="line">spec:</span><br><span class="line">  ports:</span><br><span class="line">    - port: 443</span><br><span class="line">      targetPort: 8443</span><br><span class="line">  selector:</span><br><span class="line">    k8s-app: kubernetes-dashboard</span><br><span class="line"></span><br><span class="line">---</span><br><span class="line"></span><br><span class="line">apiVersion: v1</span><br><span class="line">kind: Secret</span><br><span class="line">metadata:</span><br><span class="line">  labels:</span><br><span class="line">    k8s-app: kubernetes-dashboard</span><br><span class="line">  name: kubernetes-dashboard-certs</span><br><span class="line">  namespace: kubernetes-dashboard</span><br><span class="line">type: Opaque</span><br><span class="line"></span><br><span class="line">---</span><br><span class="line"></span><br><span class="line">apiVersion: v1</span><br><span class="line">kind: Secret</span><br><span class="line">metadata:</span><br><span class="line">  labels:</span><br><span class="line">    k8s-app: kubernetes-dashboard</span><br><span class="line">  name: kubernetes-dashboard-csrf</span><br><span class="line">  namespace: kubernetes-dashboard</span><br><span class="line">type: Opaque</span><br><span class="line">data:</span><br><span class="line">  csrf: &quot;&quot;</span><br><span class="line"></span><br><span class="line">---</span><br><span class="line"></span><br><span class="line">apiVersion: v1</span><br><span class="line">kind: Secret</span><br><span class="line">metadata:</span><br><span class="line">  labels:</span><br><span class="line">    k8s-app: kubernetes-dashboard</span><br><span class="line">  name: kubernetes-dashboard-key-holder</span><br><span class="line">  namespace: kubernetes-dashboard</span><br><span class="line">type: Opaque</span><br><span class="line"></span><br><span class="line">---</span><br><span class="line"></span><br><span class="line">kind: ConfigMap</span><br><span class="line">apiVersion: v1</span><br><span class="line">metadata:</span><br><span class="line">  labels:</span><br><span class="line">    k8s-app: kubernetes-dashboard</span><br><span class="line">  name: kubernetes-dashboard-settings</span><br><span class="line">  namespace: kubernetes-dashboard</span><br><span class="line"></span><br><span class="line">---</span><br><span class="line"></span><br><span class="line">kind: Role</span><br><span class="line">apiVersion: rbac.authorization.k8s.io/v1</span><br><span class="line">metadata:</span><br><span class="line">  labels:</span><br><span class="line">    k8s-app: kubernetes-dashboard</span><br><span class="line">  name: kubernetes-dashboard</span><br><span class="line">  namespace: kubernetes-dashboard</span><br><span class="line">rules:</span><br><span class="line">  # Allow Dashboard to get, update and delete Dashboard exclusive secrets.</span><br><span class="line">  - apiGroups: [&quot;&quot;]</span><br><span class="line">    resources: [&quot;secrets&quot;]</span><br><span class="line">    resourceNames: [&quot;kubernetes-dashboard-key-holder&quot;, &quot;kubernetes-dashboard-certs&quot;, &quot;kubernetes-dashboard-csrf&quot;]</span><br><span class="line">    verbs: [&quot;get&quot;, &quot;update&quot;, &quot;delete&quot;]</span><br><span class="line">    # Allow Dashboard to get and update &#x27;kubernetes-dashboard-settings&#x27; config map.</span><br><span class="line">  - apiGroups: [&quot;&quot;]</span><br><span class="line">    resources: [&quot;configmaps&quot;]</span><br><span class="line">    resourceNames: [&quot;kubernetes-dashboard-settings&quot;]</span><br><span class="line">    verbs: [&quot;get&quot;, &quot;update&quot;]</span><br><span class="line">    # Allow Dashboard to get metrics.</span><br><span class="line">  - apiGroups: [&quot;&quot;]</span><br><span class="line">    resources: [&quot;services&quot;]</span><br><span class="line">    resourceNames: [&quot;heapster&quot;, &quot;dashboard-metrics-scraper&quot;]</span><br><span class="line">    verbs: [&quot;proxy&quot;]</span><br><span class="line">  - apiGroups: [&quot;&quot;]</span><br><span class="line">    resources: [&quot;services/proxy&quot;]</span><br><span class="line">    resourceNames: [&quot;heapster&quot;, &quot;http:heapster:&quot;, &quot;https:heapster:&quot;, &quot;dashboard-metrics-scraper&quot;, &quot;http:dashboard-metrics-scraper&quot;]</span><br><span class="line">    verbs: [&quot;get&quot;]</span><br><span class="line"></span><br><span class="line">---</span><br><span class="line"></span><br><span class="line">kind: ClusterRole</span><br><span class="line">apiVersion: rbac.authorization.k8s.io/v1</span><br><span class="line">metadata:</span><br><span class="line">  labels:</span><br><span class="line">    k8s-app: kubernetes-dashboard</span><br><span class="line">  name: kubernetes-dashboard</span><br><span class="line">rules:</span><br><span class="line">  # Allow Metrics Scraper to get metrics from the Metrics server</span><br><span class="line">  - apiGroups: [&quot;metrics.k8s.io&quot;]</span><br><span class="line">    resources: [&quot;pods&quot;, &quot;nodes&quot;]</span><br><span class="line">    verbs: [&quot;get&quot;, &quot;list&quot;, &quot;watch&quot;]</span><br><span class="line"></span><br><span class="line">---</span><br><span class="line"></span><br><span class="line">apiVersion: rbac.authorization.k8s.io/v1</span><br><span class="line">kind: RoleBinding</span><br><span class="line">metadata:</span><br><span class="line">  labels:</span><br><span class="line">    k8s-app: kubernetes-dashboard</span><br><span class="line">  name: kubernetes-dashboard</span><br><span class="line">  namespace: kubernetes-dashboard</span><br><span class="line">roleRef:</span><br><span class="line">  apiGroup: rbac.authorization.k8s.io</span><br><span class="line">  kind: Role</span><br><span class="line">  name: kubernetes-dashboard</span><br><span class="line">subjects:</span><br><span class="line">  - kind: ServiceAccount</span><br><span class="line">    name: kubernetes-dashboard</span><br><span class="line">    namespace: kubernetes-dashboard</span><br><span class="line"></span><br><span class="line">---</span><br><span class="line"></span><br><span class="line">apiVersion: rbac.authorization.k8s.io/v1</span><br><span class="line">kind: ClusterRoleBinding</span><br><span class="line">metadata:</span><br><span class="line">  name: kubernetes-dashboard</span><br><span class="line">roleRef:</span><br><span class="line">  apiGroup: rbac.authorization.k8s.io</span><br><span class="line">  kind: ClusterRole</span><br><span class="line">  name: kubernetes-dashboard</span><br><span class="line">subjects:</span><br><span class="line">  - kind: ServiceAccount</span><br><span class="line">    name: kubernetes-dashboard</span><br><span class="line">    namespace: kubernetes-dashboard</span><br><span class="line"></span><br><span class="line">---</span><br><span class="line"></span><br><span class="line">kind: Deployment</span><br><span class="line">apiVersion: apps/v1</span><br><span class="line">metadata:</span><br><span class="line">  labels:</span><br><span class="line">    k8s-app: kubernetes-dashboard</span><br><span class="line">  name: kubernetes-dashboard</span><br><span class="line">  namespace: kubernetes-dashboard</span><br><span class="line">spec:</span><br><span class="line">  replicas: 1</span><br><span class="line">  revisionHistoryLimit: 10</span><br><span class="line">  selector:</span><br><span class="line">    matchLabels:</span><br><span class="line">      k8s-app: kubernetes-dashboard</span><br><span class="line">  template:</span><br><span class="line">    metadata:</span><br><span class="line">      labels:</span><br><span class="line">        k8s-app: kubernetes-dashboard</span><br><span class="line">    spec:</span><br><span class="line">      containers:</span><br><span class="line">        - name: kubernetes-dashboard</span><br><span class="line">          image: kubernetesui/dashboard:v2.3.1</span><br><span class="line">          imagePullPolicy: Always</span><br><span class="line">          ports:</span><br><span class="line">            - containerPort: 8443</span><br><span class="line">              protocol: TCP</span><br><span class="line">          args:</span><br><span class="line">            - --auto-generate-certificates</span><br><span class="line">            - --namespace=kubernetes-dashboard</span><br><span class="line">            # Uncomment the following line to manually specify Kubernetes API server Host</span><br><span class="line">            # If not specified, Dashboard will attempt to auto discover the API server and connect</span><br><span class="line">            # to it. Uncomment only if the default does not work.</span><br><span class="line">            # - --apiserver-host=http://my-address:port</span><br><span class="line">          volumeMounts:</span><br><span class="line">            - name: kubernetes-dashboard-certs</span><br><span class="line">              mountPath: /certs</span><br><span class="line">              # Create on-disk volume to store exec logs</span><br><span class="line">            - mountPath: /tmp</span><br><span class="line">              name: tmp-volume</span><br><span class="line">          livenessProbe:</span><br><span class="line">            httpGet:</span><br><span class="line">              scheme: HTTPS</span><br><span class="line">              path: /</span><br><span class="line">              port: 8443</span><br><span class="line">            initialDelaySeconds: 30</span><br><span class="line">            timeoutSeconds: 30</span><br><span class="line">          securityContext:</span><br><span class="line">            allowPrivilegeEscalation: false</span><br><span class="line">            readOnlyRootFilesystem: true</span><br><span class="line">            runAsUser: 1001</span><br><span class="line">            runAsGroup: 2001</span><br><span class="line">      volumes:</span><br><span class="line">        - name: kubernetes-dashboard-certs</span><br><span class="line">          secret:</span><br><span class="line">            secretName: kubernetes-dashboard-certs</span><br><span class="line">        - name: tmp-volume</span><br><span class="line">          emptyDir: &#123;&#125;</span><br><span class="line">      serviceAccountName: kubernetes-dashboard</span><br><span class="line">      nodeSelector:</span><br><span class="line">        &quot;kubernetes.io/os&quot;: linux</span><br><span class="line">      # Comment the following tolerations if Dashboard must not be deployed on master</span><br><span class="line">      tolerations:</span><br><span class="line">        - key: node-role.kubernetes.io/master</span><br><span class="line">          effect: NoSchedule</span><br><span class="line"></span><br><span class="line">---</span><br><span class="line"></span><br><span class="line">kind: Service</span><br><span class="line">apiVersion: v1</span><br><span class="line">metadata:</span><br><span class="line">  labels:</span><br><span class="line">    k8s-app: dashboard-metrics-scraper</span><br><span class="line">  name: dashboard-metrics-scraper</span><br><span class="line">  namespace: kubernetes-dashboard</span><br><span class="line">spec:</span><br><span class="line">  ports:</span><br><span class="line">    - port: 8000</span><br><span class="line">      targetPort: 8000</span><br><span class="line">  selector:</span><br><span class="line">    k8s-app: dashboard-metrics-scraper</span><br><span class="line"></span><br><span class="line">---</span><br><span class="line"></span><br><span class="line">kind: Deployment</span><br><span class="line">apiVersion: apps/v1</span><br><span class="line">metadata:</span><br><span class="line">  labels:</span><br><span class="line">    k8s-app: dashboard-metrics-scraper</span><br><span class="line">  name: dashboard-metrics-scraper</span><br><span class="line">  namespace: kubernetes-dashboard</span><br><span class="line">spec:</span><br><span class="line">  replicas: 1</span><br><span class="line">  revisionHistoryLimit: 10</span><br><span class="line">  selector:</span><br><span class="line">    matchLabels:</span><br><span class="line">      k8s-app: dashboard-metrics-scraper</span><br><span class="line">  template:</span><br><span class="line">    metadata:</span><br><span class="line">      labels:</span><br><span class="line">        k8s-app: dashboard-metrics-scraper</span><br><span class="line">      annotations:</span><br><span class="line">        seccomp.security.alpha.kubernetes.io/pod: &#x27;runtime/default&#x27;</span><br><span class="line">    spec:</span><br><span class="line">      containers:</span><br><span class="line">        - name: dashboard-metrics-scraper</span><br><span class="line">          image: kubernetesui/metrics-scraper:v1.0.6</span><br><span class="line">          ports:</span><br><span class="line">            - containerPort: 8000</span><br><span class="line">              protocol: TCP</span><br><span class="line">          livenessProbe:</span><br><span class="line">            httpGet:</span><br><span class="line">              scheme: HTTP</span><br><span class="line">              path: /</span><br><span class="line">              port: 8000</span><br><span class="line">            initialDelaySeconds: 30</span><br><span class="line">            timeoutSeconds: 30</span><br><span class="line">          volumeMounts:</span><br><span class="line">          - mountPath: /tmp</span><br><span class="line">            name: tmp-volume</span><br><span class="line">          securityContext:</span><br><span class="line">            allowPrivilegeEscalation: false</span><br><span class="line">            readOnlyRootFilesystem: true</span><br><span class="line">            runAsUser: 1001</span><br><span class="line">            runAsGroup: 2001</span><br><span class="line">      serviceAccountName: kubernetes-dashboard</span><br><span class="line">      nodeSelector:</span><br><span class="line">        &quot;kubernetes.io/os&quot;: linux</span><br><span class="line">      # Comment the following tolerations if Dashboard must not be deployed on master</span><br><span class="line">      tolerations:</span><br><span class="line">        - key: node-role.kubernetes.io/master</span><br><span class="line">          effect: NoSchedule</span><br><span class="line">      volumes:</span><br><span class="line">        - name: tmp-volume</span><br><span class="line">          emptyDir: &#123;&#125;</span><br></pre></td></tr></table></figure>

<h2 id="2、设置访问端口"><a href="#2、设置访问端口" class="headerlink" title="2、设置访问端口"></a>2、设置访问端口</h2><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">kubectl edit svc kubernetes-dashboard -n kubernetes-dashboard</span><br></pre></td></tr></table></figure>

<p>type: ClusterIP 改为 type: NodePort</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">kubectl get svc -A |grep kubernetes-dashboard</span><br><span class="line">## 找到端口，在安全组放行</span><br></pre></td></tr></table></figure>

<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">访问： https://集群任意IP:端口      https://139.198.165.238:32759</span><br></pre></td></tr></table></figure>

<h2 id="3、创建访问账号"><a href="#3、创建访问账号" class="headerlink" title="3、创建访问账号"></a>3、创建访问账号</h2><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br></pre></td><td class="code"><pre><span class="line">#创建访问账号，准备一个yaml文件； vi dash.yaml</span><br><span class="line">apiVersion: v1</span><br><span class="line">kind: ServiceAccount</span><br><span class="line">metadata:</span><br><span class="line">  name: admin-user</span><br><span class="line">  namespace: kubernetes-dashboard</span><br><span class="line">---</span><br><span class="line">apiVersion: rbac.authorization.k8s.io/v1</span><br><span class="line">kind: ClusterRoleBinding</span><br><span class="line">metadata:</span><br><span class="line">  name: admin-user</span><br><span class="line">roleRef:</span><br><span class="line">  apiGroup: rbac.authorization.k8s.io</span><br><span class="line">  kind: ClusterRole</span><br><span class="line">  name: cluster-admin</span><br><span class="line">subjects:</span><br><span class="line">- kind: ServiceAccount</span><br><span class="line">  name: admin-user</span><br><span class="line">  namespace: kubernetes-dashboard</span><br></pre></td></tr></table></figure>

<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">kubectl apply -f dash.yaml</span><br></pre></td></tr></table></figure>

<h2 id="4、令牌访问"><a href="#4、令牌访问" class="headerlink" title="4、令牌访问"></a>4、令牌访问</h2><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">#获取访问令牌</span><br><span class="line">kubectl -n kubernetes-dashboard get secret $(kubectl -n kubernetes-dashboard get sa/admin-user -o jsonpath=&quot;&#123;.secrets[0].name&#125;&quot;) -o go-template=&quot;&#123;&#123;.data.token | base64decode&#125;&#125;&quot;</span><br></pre></td></tr></table></figure>

<p>根据令牌登录即可</p>
<h1 id="七、常见错误解决"><a href="#七、常见错误解决" class="headerlink" title="七、常见错误解决"></a>七、常见错误解决</h1><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">The connection to the server localhost:8080 was refused - did you specify the right host or port?</span><br></pre></td></tr></table></figure>

<p>原因：kubernetes master没有与本机绑定，集群初始化的时候没有绑定，此时设置在本机的环境变量即可解决问题。</p>
<p>解决：</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">echo &quot;export KUBECONFIG=/etc/kubernetes/admin.conf&quot; &gt;&gt; /etc/profile</span><br></pre></td></tr></table></figure>

<p>使生效</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">source /etc/profile</span><br></pre></td></tr></table></figure>
</article><div class="post-copyright"><div class="post-copyright__author"><span class="post-copyright-meta">文章作者: </span><span class="post-copyright-info"><a href="mailto:undefined">惜缘怀古</a></span></div><div class="post-copyright__type"><span class="post-copyright-meta">文章链接: </span><span class="post-copyright-info"><a href="https://xiyuanhuaigu.gitee.io/2023/03/06/k8s%E5%85%AC%E7%BD%91%E9%83%A8%E7%BD%B2/">https://xiyuanhuaigu.gitee.io/2023/03/06/k8s%E5%85%AC%E7%BD%91%E9%83%A8%E7%BD%B2/</a></span></div><div class="post-copyright__notice"><span class="post-copyright-meta">版权声明: </span><span class="post-copyright-info">本博客所有文章除特别声明外，均采用 <a href="https://creativecommons.org/licenses/by-nc-sa/4.0/" target="_blank">CC BY-NC-SA 4.0</a> 许可协议。转载请注明来自 <a href="https://xiyuanhuaigu.gitee.io" target="_blank">惜缘怀古的博客</a>！</span></div></div><div class="tag_share"><div class="post-meta__tag-list"></div><div class="post_share"><div class="social-share" data-image="https://xyhutc.oss-cn-qingdao.aliyuncs.com/giteetuchuang/9604cc9e45e234d534bda903e231df3e5be0b6c8_raw.jpg" data-sites="facebook,twitter,wechat,weibo,qq"></div><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/social-share.js/dist/css/share.min.css" media="print" onload="this.media='all'"><script src="https://cdn.jsdelivr.net/npm/social-share.js/dist/js/social-share.min.js" defer></script></div></div><nav class="pagination-post" id="pagination"><div class="prev-post pull-left"><a href="/2023/03/19/adb%E5%B8%B8%E7%94%A8%E5%91%BD%E4%BB%A4/"><img class="prev-cover" src="https://xyhutc.oss-cn-qingdao.aliyuncs.com/giteetuchuang/ff85cc4786da34186bf213de6ac1d1ce1349c250_raw.jpg" onerror="onerror=null;src='/img/404.jpg'" alt="cover of previous post"><div class="pagination-info"><div class="label">上一篇</div><div class="prev_info">adb常用命令</div></div></a></div><div class="next-post pull-right"><a href="/2023/01/13/%E4%BD%BF%E7%94%A8kubeadm%E5%BF%AB%E9%80%9F%E9%83%A8%E7%BD%B2%E4%B8%80%E4%B8%AAk8s%E9%9B%86%E7%BE%A4/"><img class="next-cover" src="https://xyhutc.oss-cn-qingdao.aliyuncs.com/giteetuchuang/67a9fe345eeaa896812eb93135af4396761d850b_raw.jpg" onerror="onerror=null;src='/img/404.jpg'" alt="cover of next post"><div class="pagination-info"><div class="label">下一篇</div><div class="next_info">使用kubeadm快速部署一个k8s集群</div></div></a></div></nav></div><div class="aside-content" id="aside-content"><div class="card-widget card-info"><div class="is-center"><div class="avatar-img"><img src="/img/2.jpg" onerror="this.onerror=null;this.src='/img/friend_404.gif'" alt="avatar"/></div><div class="author-info__name">惜缘怀古</div><div class="author-info__description">唯有那份炫目，未曾忘却</div></div><div class="card-info-data is-center"><div class="card-info-data-item"><a href="/archives/"><div class="headline">文章</div><div class="length-num">66</div></a></div><div class="card-info-data-item"><a href="/tags/"><div class="headline">标签</div><div class="length-num">0</div></a></div><div class="card-info-data-item"><a href="/categories/"><div class="headline">分类</div><div class="length-num">0</div></a></div></div><a class="button--animated" id="card-info-btn" target="_blank" rel="noopener" href="https://github.com/xxxxxx"><i class="fab fa-github"></i><span>Follow Me</span></a></div><div class="card-widget card-announcement"><div class="item-headline"><i class="fas fa-bullhorn card-announcement-animation"></i><span>公告</span></div><div class="announcement_content">This is my Blog</div></div><div class="sticky_layout"><div class="card-widget" id="card-toc"><div class="item-headline"><i class="fas fa-stream"></i><span>目录</span><span class="toc-percentage"></span></div><div class="toc-content"><ol class="toc"><li class="toc-item toc-level-1"><a class="toc-link" href="#%E4%B8%80%E3%80%81%E5%87%86%E5%A4%87%E5%B7%A5%E4%BD%9C"><span class="toc-number">1.</span> <span class="toc-text">一、准备工作</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#1-%E7%89%88%E6%9C%AC%E4%BF%A1%E6%81%AF"><span class="toc-number">1.1.</span> <span class="toc-text">1.版本信息</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#2-%E9%9B%86%E7%BE%A4%E8%A7%92%E8%89%B2%E8%A7%84%E5%88%92"><span class="toc-number">1.2.</span> <span class="toc-text">2.集群角色规划</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#3-%E4%BF%AE%E6%94%B9-hosts-%E6%96%87%E4%BB%B6"><span class="toc-number">1.3.</span> <span class="toc-text">3.修改 hosts 文件</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#4-%E5%88%9B%E5%BB%BA%E8%99%9A%E6%8B%9F%E7%BD%91%E5%8D%A1"><span class="toc-number">1.4.</span> <span class="toc-text">4.创建虚拟网卡</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#5-%E4%BA%91%E6%9C%8D%E5%8A%A1%E5%99%A8%E5%AE%89%E5%85%A8%E7%BB%84%E8%AE%BE%E7%BD%AE"><span class="toc-number">1.5.</span> <span class="toc-text">5.云服务器安全组设置</span></a></li></ol></li><li class="toc-item toc-level-1"><a class="toc-link" href="#%E4%BA%8C%E3%80%81%E7%B3%BB%E7%BB%9F%E5%9F%BA%E7%A1%80%E9%85%8D%E7%BD%AE"><span class="toc-number">2.</span> <span class="toc-text">二、系统基础配置</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#1-%E6%9B%B4%E6%96%B0%E5%B9%B6%E5%AE%89%E8%A3%85%E4%BE%9D%E8%B5%96"><span class="toc-number">2.1.</span> <span class="toc-text">1.更新并安装依赖</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#2-%E5%9F%BA%E7%A1%80%E9%85%8D%E7%BD%AE"><span class="toc-number">2.2.</span> <span class="toc-text">2.基础配置</span></a></li></ol></li><li class="toc-item toc-level-1"><a class="toc-link" href="#%E4%B8%89%E3%80%81%E5%AE%89%E8%A3%85-Docker"><span class="toc-number">3.</span> <span class="toc-text">三、安装 Docker</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#1-%E9%85%8D%E7%BD%AE%E9%98%BF%E9%87%8C%E4%BA%91%E9%95%9C%E5%83%8F%E6%BA%90"><span class="toc-number">3.1.</span> <span class="toc-text">1.配置阿里云镜像源</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#2-%E5%AE%89%E8%A3%85-Docker"><span class="toc-number">3.2.</span> <span class="toc-text">2.安装 Docker</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#3-%E5%90%AF%E5%8A%A8-Docker"><span class="toc-number">3.3.</span> <span class="toc-text">3.启动 Docker</span></a></li></ol></li><li class="toc-item toc-level-1"><a class="toc-link" href="#%E5%9B%9B%E3%80%81%E5%AE%89%E8%A3%85-Kubernetes-%E9%9B%86%E7%BE%A4%E6%89%80%E9%9C%80%E7%BB%84%E4%BB%B6"><span class="toc-number">4.</span> <span class="toc-text">四、安装 Kubernetes 集群所需组件</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#%E4%B8%80-%E5%AE%89%E8%A3%85-kubeadm-kubelete-kubectl"><span class="toc-number">4.1.</span> <span class="toc-text">(一) 安装 kubeadm, kubelete, kubectl</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#1-%E9%85%8D%E7%BD%AE-yum-%E6%BA%90"><span class="toc-number">4.1.1.</span> <span class="toc-text">1.配置 yum 源</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#2-%E5%BC%80%E5%A7%8B%E5%AE%89%E8%A3%85"><span class="toc-number">4.1.2.</span> <span class="toc-text">2.开始安装</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#3-Docker-%E5%92%8C-K8s-%E8%AE%BE%E7%BD%AE%E4%B8%BA%E5%90%8C%E4%B8%80%E4%B8%AA-cgroup"><span class="toc-number">4.1.3.</span> <span class="toc-text">3.Docker 和 K8s 设置为同一个 cgroup</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#4-%E4%BF%AE%E6%94%B9-kubelet-%E5%90%AF%E5%8A%A8%E5%8F%82%E6%95%B0"><span class="toc-number">4.1.4.</span> <span class="toc-text">4.修改 kubelet 启动参数</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#5-%E5%90%AF%E5%8A%A8-kubelet-%E9%87%8D%E5%90%AF-kubelet"><span class="toc-number">4.1.5.</span> <span class="toc-text">5.启动 kubelet &#x2F; 重启 kubelet</span></a></li></ol></li><li class="toc-item toc-level-2"><a class="toc-link" href="#%E4%BA%8C-%E6%8B%89%E5%8F%96-kube-proxy-scheduler-%E7%AD%89%E9%95%9C%E5%83%8F"><span class="toc-number">4.2.</span> <span class="toc-text">(二) 拉取 kube-proxy, scheduler 等镜像</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#1-%E6%9F%A5%E7%9C%8B-kubeadm-%E6%89%80%E9%9C%80%E9%95%9C%E5%83%8F"><span class="toc-number">4.2.1.</span> <span class="toc-text">1.查看 kubeadm 所需镜像</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#2-%E5%B0%9D%E8%AF%95%E7%94%A8%E5%9B%BD%E5%86%85%E9%95%9C%E5%83%8F%E6%BA%90%E6%8B%89%E5%8F%96%E9%95%9C%E5%83%8F"><span class="toc-number">4.2.2.</span> <span class="toc-text">2.尝试用国内镜像源拉取镜像</span></a></li></ol></li></ol></li><li class="toc-item toc-level-1"><a class="toc-link" href="#%E4%BA%94%E3%80%81%E6%90%AD%E5%BB%BA-Kubernetes-%E9%9B%86%E7%BE%A4"><span class="toc-number">5.</span> <span class="toc-text">五、搭建 Kubernetes 集群</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#%E4%B8%80-%E7%94%A8-kubeadm-%E5%88%9D%E5%A7%8B%E5%8C%96-master-%E8%8A%82%E7%82%B9"><span class="toc-number">5.1.</span> <span class="toc-text">(一)用 kubeadm 初始化 master 节点</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#1-%E6%89%A7%E8%A1%8C-kubeadm-init"><span class="toc-number">5.1.1.</span> <span class="toc-text">1.执行 kubeadm init</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#2-%E9%9B%86%E7%BE%A4%E5%81%A5%E5%BA%B7%E6%A3%80%E6%9F%A5"><span class="toc-number">5.1.2.</span> <span class="toc-text">2.集群健康检查</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#3-%E4%BF%AE%E6%94%B9kube-apiserver-%E9%85%8D%E7%BD%AE"><span class="toc-number">5.1.3.</span> <span class="toc-text">3.修改kube-apiserver 配置</span></a></li></ol></li><li class="toc-item toc-level-2"><a class="toc-link" href="#%E4%BA%8C-%E5%AE%89%E8%A3%85%E7%BD%91%E7%BB%9C%E6%8F%92%E4%BB%B6-Flannel"><span class="toc-number">5.2.</span> <span class="toc-text">(二)安装网络插件 Flannel</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#1-%E5%BD%93%E5%89%8D%E9%9B%86%E7%BE%A4%E7%8A%B6%E6%80%81"><span class="toc-number">5.2.1.</span> <span class="toc-text">1.当前集群状态</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#2-%E5%AE%89%E8%A3%85-Flannel-%E7%BD%91%E7%BB%9C%E6%8F%92%E4%BB%B6"><span class="toc-number">5.2.2.</span> <span class="toc-text">2.安装 Flannel 网络插件</span></a></li></ol></li><li class="toc-item toc-level-2"><a class="toc-link" href="#%E4%B8%89-%E7%94%A8-kubeadm-%E5%B0%86%E4%BB%8E%E8%8A%82%E7%82%B9%E5%8A%A0%E5%85%A5%E9%9B%86%E7%BE%A4"><span class="toc-number">5.3.</span> <span class="toc-text">(三)用 kubeadm 将从节点加入集群</span></a></li></ol></li><li class="toc-item toc-level-1"><a class="toc-link" href="#%E5%85%AD%E3%80%81%E9%83%A8%E7%BD%B2dashboard"><span class="toc-number">6.</span> <span class="toc-text">六、部署dashboard</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#1%E3%80%81%E9%83%A8%E7%BD%B2"><span class="toc-number">6.1.</span> <span class="toc-text">1、部署</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#2%E3%80%81%E8%AE%BE%E7%BD%AE%E8%AE%BF%E9%97%AE%E7%AB%AF%E5%8F%A3"><span class="toc-number">6.2.</span> <span class="toc-text">2、设置访问端口</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#3%E3%80%81%E5%88%9B%E5%BB%BA%E8%AE%BF%E9%97%AE%E8%B4%A6%E5%8F%B7"><span class="toc-number">6.3.</span> <span class="toc-text">3、创建访问账号</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#4%E3%80%81%E4%BB%A4%E7%89%8C%E8%AE%BF%E9%97%AE"><span class="toc-number">6.4.</span> <span class="toc-text">4、令牌访问</span></a></li></ol></li><li class="toc-item toc-level-1"><a class="toc-link" href="#%E4%B8%83%E3%80%81%E5%B8%B8%E8%A7%81%E9%94%99%E8%AF%AF%E8%A7%A3%E5%86%B3"><span class="toc-number">7.</span> <span class="toc-text">七、常见错误解决</span></a></li></ol></div></div><div class="card-widget card-recent-post"><div class="item-headline"><i class="fas fa-history"></i><span>最新文章</span></div><div class="aside-list"><div class="aside-list-item"><a class="thumbnail" href="/2023/11/06/2023%E8%93%9D%E5%B8%BD%E6%9D%AF%E5%86%B3%E8%B5%9BWP/" title="2023蓝帽杯决赛WP"><img src="https://xyhutc.oss-cn-qingdao.aliyuncs.com/giteetuchuang/20231106163334.png" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="2023蓝帽杯决赛WP"/></a><div class="content"><a class="title" href="/2023/11/06/2023%E8%93%9D%E5%B8%BD%E6%9D%AF%E5%86%B3%E8%B5%9BWP/" title="2023蓝帽杯决赛WP">2023蓝帽杯决赛WP</a><time datetime="2023-11-06T08:31:51.000Z" title="发表于 2023-11-06 16:31:51">2023-11-06</time></div></div><div class="aside-list-item"><a class="thumbnail" href="/2023/10/20/%E6%94%BB%E9%98%B2%E4%B8%96%E7%95%8CRE/" title="攻防世界RE"><img src="https://xyhutc.oss-cn-qingdao.aliyuncs.com/giteetuchuang/c78ed35b1e3999643d52a652257558af0a15b4c9_raw.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="攻防世界RE"/></a><div class="content"><a class="title" href="/2023/10/20/%E6%94%BB%E9%98%B2%E4%B8%96%E7%95%8CRE/" title="攻防世界RE">攻防世界RE</a><time datetime="2023-10-20T12:38:32.000Z" title="发表于 2023-10-20 20:38:32">2023-10-20</time></div></div><div class="aside-list-item"><a class="thumbnail" href="/2023/09/22/%E5%AE%89%E5%8D%93%E5%B8%B8%E7%94%A8%E7%9B%AE%E5%BD%95/" title="安卓常用目录"><img src="https://xyhutc.oss-cn-qingdao.aliyuncs.com/giteetuchuang/mmexport1694863328916.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="安卓常用目录"/></a><div class="content"><a class="title" href="/2023/09/22/%E5%AE%89%E5%8D%93%E5%B8%B8%E7%94%A8%E7%9B%AE%E5%BD%95/" title="安卓常用目录">安卓常用目录</a><time datetime="2023-09-22T01:27:02.000Z" title="发表于 2023-09-22 09:27:02">2023-09-22</time></div></div><div class="aside-list-item"><a class="thumbnail" href="/2023/09/22/010Editor%E7%A0%B4%E8%A7%A3/" title="010Editor破解"><img src="https://xyhutc.oss-cn-qingdao.aliyuncs.com/giteetuchuang/1694867487605.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="010Editor破解"/></a><div class="content"><a class="title" href="/2023/09/22/010Editor%E7%A0%B4%E8%A7%A3/" title="010Editor破解">010Editor破解</a><time datetime="2023-09-22T00:33:10.000Z" title="发表于 2023-09-22 08:33:10">2023-09-22</time></div></div><div class="aside-list-item"><a class="thumbnail" href="/2023/08/24/%E6%9F%90APP%E7%9A%84%E9%80%86%E5%90%91%E5%88%86%E6%9E%90/" title="某APP的逆向分析"><img src="https://xyhutc.oss-cn-qingdao.aliyuncs.com/giteetuchuang/a4c8982faff8839d06cc010c864e02e8092efb23_raw.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="某APP的逆向分析"/></a><div class="content"><a class="title" href="/2023/08/24/%E6%9F%90APP%E7%9A%84%E9%80%86%E5%90%91%E5%88%86%E6%9E%90/" title="某APP的逆向分析">某APP的逆向分析</a><time datetime="2023-08-24T14:02:11.000Z" title="发表于 2023-08-24 22:02:11">2023-08-24</time></div></div></div></div></div></div></main><footer id="footer"><div id="footer-wrap"><div class="copyright">&copy;2020 - 2024 By 惜缘怀古</div><div class="framework-info"><span>框架 </span><a target="_blank" rel="noopener" href="https://hexo.io">Hexo</a><span class="footer-separator">|</span><span>主题 </span><a target="_blank" rel="noopener" href="https://github.com/jerryc127/hexo-theme-butterfly">Butterfly</a></div></div></footer></div><div id="rightside"><div id="rightside-config-hide"><button id="readmode" type="button" title="阅读模式"><i class="fas fa-book-open"></i></button><button id="darkmode" type="button" title="浅色和深色模式转换"><i class="fas fa-adjust"></i></button><button id="hide-aside-btn" type="button" title="单栏和双栏切换"><i class="fas fa-arrows-alt-h"></i></button></div><div id="rightside-config-show"><button id="rightside_config" type="button" title="设置"><i class="fas fa-cog fa-spin"></i></button><button class="close" id="mobile-toc-button" type="button" title="目录"><i class="fas fa-list-ul"></i></button><button id="go-up" type="button" title="回到顶部"><i class="fas fa-arrow-up"></i></button></div></div><div><script src="/js/utils.js"></script><script src="/js/main.js"></script><script src="https://cdn.jsdelivr.net/npm/@fancyapps/ui/dist/fancybox.umd.js"></script><div class="js-pjax"></div><script async data-pjax src="//busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js"></script></div></body></html>